CVE-2026-54766

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.21.0 through 2.3.0

Description An authorization bypass exists in the project duplication process. An authenticated user with read access to a source project can duplicate it and place the copy under any arbitrary target parent project, regardless of whether they have write permissions for that parent. This allows an attacker to inject their own projects into the project hierarchies of other users or teams, potentially enabling spam or phishing within another tenant's workspace.

The issue occurs because the ProjectDuplicate.CanCreate() function in pkg/models/project duplicate.go incorrectly calls parent.CanCreate() instead of parent.CanWrite(). Additionally, the parent project object is not loaded from the database (unhydrated), causing the permission check to be skipped and return true for any authenticated user. This flaw affects the PUT /api/v1/projects/{project}/duplicate endpoint and the parent project id variable.

Recommendations Update Vikunja to version 2.4.0. As a temporary workaround, restrict access to the PUT /api/v1/projects/{project}/duplicate endpoint to minimize the risk of unauthorized project injection.